Linux

Ask something
Discussion Locked

A Linux Router/Firewall

0 helpful
5 replies

by mnsain

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I'm going to try and explain this the best I can, and hope you all understand what I'm talking about. So here goes...

My customer has a Frame-Relay T1 into a Cisco Router (Which provides a firewall). Customer runs his web-page off of a Linux server and has some content on an NT running a Web Server+SSL. He also has 13 or so pcANYWHERE hosts for remote access (I know, BIG security no-no).

The customer does not possess the password to the router so they get to pay $200 every time they want to make a change. And access to the pcANYWHERE hosts are currently unsecured.

The Linux server has two network adapters; one public and one private. The ideal situation is to put the Linux server in between the router and the rest of the network. To do that, I am required to move all the public hosts and servers into the local network and somehow map ports from the public IPs through the firewall. Outbound traffic is not a problem thanks to IP masquerading.

The problem is that I do not know how to get the Linux server to answer requests for IPs that are not bound to its interfaces.

Any suggestions would be greatly appriciated.

5 replies

by mckaytech

You've picked the perfect solution - you just need to add "port forwarding" to your IPCHAINS configuration. What these rules do is forward anything received on Port 80 (or 21 or whatever you're serving) on the public interface to an IP address and port number on the inside that you define.

For example, my configuration script has a statement like this to forward Web requests:

IPMASQUADM portfw -a -P tcp -L $EXTERN_IP www -R $INTERN_FTP_SERVER www

You can also address the other problemwith unsecured pcAnywhere sessions. You can either configure port forwarding or use my favorite solution which is to run SSHD on the Linux box, VNC on the workstations to be controlled and TeraTerm Pro with the SSH extension and VNC on the outside boxes. The user brings up TeraTerm to build a tunnel from the workstation to the Linux server, uses TCP/IP forwarding on the TeraTerm and then starts a VNC session with the target workstation. Clean, secure and..... all free GPL software.

And, incidentally, rather than tying up your Linux server, you could do all this with a surplus 486/12meg of RAM with no hard drive using the Linux Router Project software. Add SSHD and the Seattle Firewall software and the configuration is almost effortless.

paul

by mnsain

Ok, I have tried this...

linux server is XXX.XXX.XXX.4

ipmasqadm portfw -a -P tcp -L XXX.XXX.XXX.6 5163 -R 192.168.200.6 5163

With no avail. It's like the server ignores the packet because it isn't assigned to an interface.

by mckaytech

Yep, you're right that unless the IP address is bound to the interface, the packet won't get routed.

Have you tried binding the multiple IP addresses to the external NIC?

paul

by mnsain

Oh yeah. That was one of the first things I tried. I'm outta ideas, that's why I'm posting here.

This discussion is closed to new replies.